From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f178.google.com (mail-yw1-f178.google.com [209.85.128.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B3F20345CAA for ; Thu, 20 Aug 2026 02:07:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787191661; cv=none; b=btQoZtcMivtYjkkXtNvBv3b6SWHZ2ZgK1bHD3sSMajXgm3cZ5L3PPD+u+C6xEg/ZTuat6+7xtBFQy9F9ekDAOu1CVc1h3dLTRXp5pA8TbrLXu/AvIs1qrhsEXCH2qrrWlfoPPxUhIRprrAE9tR1ENCwLmshea9wX128TaW1/8kQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787191661; c=relaxed/simple; bh=8z7PVI42mn2WVqzNpbyIUg7oPZyfo6P99lqt+Em5bE0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=bNzgpg33o4qs63F2DMEwE68nnUfi6nkJpg7GRvRbtTRd6+t8Jgl8fxMRfaHYyGQ9tY84CyFlWxb9GuEm1Tb5gWcbWvqkASr6C7vXE74GZQZ1nr1fAWeyQTaSApcPIFb4SQiIaqiHPbwPrLLz6257MOqA28sFpFFqgs7MCXsidvc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=EXj5fepF; arc=none smtp.client-ip=209.85.128.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="EXj5fepF" Received: by mail-yw1-f178.google.com with SMTP id 00721157ae682-836c718715fso21934447b3.0 for ; Wed, 19 Aug 2026 19:07:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787191658; x=1787796458; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=EZXALN7AqQrJoBL0yRkSadiom91oJHrBe491klEQ3M8=; b=EXj5fepFZ0XIiP7aJYyAeZg8LCrmH4ZXTKPfDxcX0Xt423JxeWkpX5t9wYeOnnQYCt 8c36euVlPc7kjLiEqmlWHeJZ2UNi6z8Busqad7vS1MFVdxpUVXUu1SDm1apdvs2LB2pU M1rxb14+ySq3kxRfpzrOlRKgzbZAHOL1h6zTxkgEalg74O9qb3m9FQ2QvtRP/B5kaivm 2lgcq1PGWKD0qF16dqNgCDdxkll7thg2yEIqysbQRd6r1jAks87NslifdO5JOBSWGX7t zcGkTdu0oty8/yrmMzO/ntnVzmPpuz+VTSJfV+B6xd4wJunv5UZkt/gIK/KadFurxifN CmvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787191658; x=1787796458; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=EZXALN7AqQrJoBL0yRkSadiom91oJHrBe491klEQ3M8=; b=XNpsdXpdtJ1xp6GCUslMyiNe+YJtNxxk1nfzWy9sGPEjfnhWE7VfS0yn3F1GBXOwJz 5Ejarrvq1KPi4jNl2jdODQjo2nU16NkeLi7LDmLb5B5Lnq7wprf6JQfDw/sezqIUmUZs MH6XAYDsWKxB+8rFgaeWVyTQDY+Xwg7XzJs+t0vEye2Q3f+ypF/b65ysdBwh4jIdQKN+ tqPTX2I9spo1oUPC/7TD95XOeHBWkZYm+cjbdYjaFL18SRzZXnn0hkvIAIMmdqEKVXEL +BSB4Z8zjvr2UAvUISjRMZLe1jA/zxPdFy+FNEcD8j7sGFFVbDvpc7qFvQuD3yEBxvBo Umyw== X-Forwarded-Encrypted: i=1; AHgh+Romwtu1sLyZOZ3sWYSL7i2msjo7LRo6yvgtiPgCKesCRw7Uz8DRlp1GOXmL651VyT9Ka5NzUYbpxnFBA18=@vger.kernel.org X-Gm-Message-State: AFuF++nW1SCNkUB2py0cRdxjA1dFqEzAtsBZ1xo8RicV1TtXfxZoH6IZ 5GpVey7Uzj65TcoMAHIkmodsbtILjZ+msUbjYlxqVT37eD8RDg1jNWsF X-Gm-Gg: AR+sD13M0n/dBIhEsReDFGAq0WdTljfZVtAaaS1WOGMErYH8BF72Jrey6Y3GM8nN4ah qT9iRfeCqbzGVKNXiqdCJ/vmpBQk2JcOYzyjCT08W0UQUf7a78WfFqlOSSAVNwqzVKfnZo40emP pOCL9qUh/RZ30NA7qwtByQ+tL6hzDwgHStmPZ7zHaeUKX+uJUUcmWzaOR6TWJ4anRRjFyikBDgP fs3Sf502k3Xwt5Im/u03FrorZyajw2+0CWSi6AmnwPTmpUw7CL2+AmaYneZ7ThkPsuDbHAN/deS Udq1kEf88conu9kgrYGveeXc9r8KNQl2jCG+tG4zdTZvMT8oEL4mamRaFszVY32OFpEKEZ4nTHT 4o/O1hL7R70lra42f1qs2mI6ylZvZ6MYFprvQwSbJpPK7cL0pWL20xsWmwY6tpc8Mjnk8NLGAkZ yu100yc6o48BjTo8/SMYx1Yjkw3pkLS2OSMF3vhuxYq/IN8EIcaeu03saScDm5sZjlmugYfyRMc MMp9Q== X-Received: by 2002:a05:690c:660c:b0:81e:8e36:e98c with SMTP id 00721157ae682-844dc78ba17mr39333887b3.0.1787191657676; Wed, 19 Aug 2026 19:07:37 -0700 (PDT) Received: from mac.lan ([136.55.173.105]) by smtp.gmail.com with ESMTPSA id 00721157ae682-847ccd8b6cbsm2169427b3.27.2026.08.19.19.07.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 19:07:37 -0700 (PDT) From: "Cen Zhang (Microsoft)" To: pablo@netfilter.org, laforge@gnumonks.org, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: osmocom-net-gprs@lists.osmocom.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, AutonomousCodeSecurity@microsoft.com, xmei5@asu.edu, tgopinath@linux.microsoft.com, kys@microsoft.com, blbllhy@gmail.com Subject: [PATCH net v2] gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free Date: Wed, 19 Aug 2026 22:07:35 -0400 Message-ID: <20260820020735.59474-1-blbllhy@gmail.com> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit gtp_newlink()'s error path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing sk_user_data. A concurrent gtp_encap_recv() in softirq may still hold the gtp_dev pointer obtained via rcu_dereference_sk_user_data() and access the freed memory. BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152) Call Trace: gtp0_pdp_find+0x1f6/0x200 gtp_encap_recv+0x527/0x24b0 udp_queue_rcv_one_skb+0x75f/0xc10 Add synchronize_net() before the kfree calls in out_hashtable, which covers all error paths from both gtp_encap_enable() and gtp_create_sockets(). Fixes: 459aa660eb1d8ce6 ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Reported-by: AutonomousCodeSecurity@microsoft.com Reported-by: Xiang Mei (Microsoft) Reported-by: Cen Zhang (Microsoft) Signed-off-by: Cen Zhang (Microsoft) --- v2: Add the net tree subject prefix. drivers/net/gtp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 9a12cc53da00..f11bcc0c0ac4 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -1543,6 +1543,8 @@ static int gtp_newlink(struct net_device *dev, out_encap: gtp_encap_disable(gtp); out_hashtable: + /* Wait for RCU readers that may still reference this gtp_dev. */ + synchronize_net(); kfree(gtp->addr_hash); kfree(gtp->tid_hash); return err; -- 2.52.0